Access to applications, servers and network resources is the cornerstone of enterprise IT, which is all about enabling connectivity. Not every account should have full access to everything in an enterprise; however, which is where superuser or privileged accounts come into play.
With a privileged account, a user has administrative access to enterprise resources, a capability that should be closely guarded. As fans of Marvel Comics know well, with great power comes great responsibility. Privileged access management (PAM) is a way to limit access to those critical assets and prevent data breaches.
However, traditional privileged identity management solutions require organizations to create and manage identities for outsourced IT administrators within their internal environment and grant full VPN access. This practice increases risk, as the gap between the number of disconnected privileged accounts and an authoritative identity provider grows, and more laptops establish VPN connections to internal networks. The result is an expansion of potential attack points for hackers, disgruntled insiders, and malware.
While privileged access management (PAM) is one of the most crucial aspects of effective cybersecurity, it requires a strategy that includes the right people, process, and technology.
Five key elements can set you on the path to successfully securing privileged access:
1. Beware local accounts
Once a user gets administrative rights for a system, more often than not, the user will create a secondary or local account that still has full access but isn’t correctly identified in a directory system like Active Directory.
“Discovering all the local accounts is often the most surprising thing for security teams because they assume all the accounts listed in Active Directory are domain accounts,” Lanzi said. “In fact, the way that Active Directory works, you can have local accounts, and that’s often where little pockets of privileged access hideout.”
To eliminate unnecessary accounts and specify which accounts and users can access critical assets, you need to identify every use of privileged access, both on-premises and in the cloud. It includes traditional and non-traditional accounts used by people—including personal and shared accounts as well as administrative accounts such as local administrator and root—and by software. Because systems, applications, and accounts are constantly being updated, it’s essential to establish a continuous process.
2. Implement Federation
To reduce the risk of attackers gaining access to critical systems or sensitive data, give users only the bare minimum privileges needed to do their jobs. Make sure you remove full local administrator access to endpoints.
Identity and access management (IAM) controls can help you grant least privilege access based on who’s requesting it, the context of the request, and the risk of the access environment without downtime or loss of productivity. When individual accounts require the ability to execute privileged tasks, PAM solutions can help you enable access that is confined to the scope and time needed to complete the activity and remove that access afterwards.
Creating and managing identities for outsourced personnel within the enterprise environment can become unmanageable and introduce unnecessary risks. But federated trust between organizations allows the enterprise to maintain an efficient separation of responsibilities.
The outsourcing service organization should have its own identity store in place, so they retain the management of their employee identities. Privileged access to specific resources should be governed through automated request and approval workflows, monitoring with optional termination of privileged sessions and reconciliation of approved access versus actual critical infrastructure access.
3. Develop a Privileged Account Password Policy
It’s critical to create clear policies that everyone who uses and manages privileged accounts can understand and accept. Put in place a privileged account password protection policy that covers human and non-human accounts to prevent unauthorized access and demonstrate compliance with regulations.
You should use long passphrases–rather than seemingly complex passwords–and multi-factor authentication for human accounts. For non-human (services and applications) accounts, passwords should be changed frequently.
PAM controls automatically randomize, manage, and vault passwords, and enable you to update all privileged account passwords automatically and simultaneously.
4. Control Hybrid Infrastructure
As organizations increasingly opt for a hybrid IT infrastructure — moving their workloads to the cloud — maintaining or gaining control becomes more challenging. To mitigate risk, IT must consistently control access to hybrid infrastructure for both on-premises and remote users. It requires a privileged identity management solution that enforces a consistent privileged access security model across public cloud, private cloud, and on-premises apps and infrastructure.
For example, Centrify provides a comprehensive privileged identity management solution to protect access and simplify enterprise adoption of Infrastructure-as-a-Service (IaaS). Organizations can extend and apply their on-premises security model for infrastructure and apps to the cloud while keeping sensitive data secure.
5. Focus on Access, Not Credentials
There is a movement in IT toward using fewer passwords in favour of using additional forms of strong authentication.
As such, password vault solutions are of limited utility, as simple credentials are not the only way that access is being granted.
Central enforcement policies for governing privileged access are critical. Governance should include monitoring privileged sessions across on-premises and cloud-based infrastructure to identify inappropriate use of privileged accounts or the source of a security incident. IT can also implement termination policies to revoke access privileges when violations are identified.
Governing all privileged user activities with session monitoring and auditing allows IT organizations to identify suspicious user activity, conduct forensic investigations, and prove compliance.
Conclusion
Managing privileged access helps organizations prevent devastating data breaches and comply with regulatory requirements. But it can be difficult for security teams that are understaffed and struggling to maintain access information across complex IT infrastructures.
By establishing comprehensive visibility into privileged accounts, enacting sound policies, implementing least privilege, investing in the right solutions, and monitoring activity, you can prevent privileged accounts from being abused and effectively tackle security risks both inside and outside your organization.
As your enterprise grows beyond the traditional network perimeter, so does the complexity of securely managing access to critical resources. Implementing these five steps allows you to minimize the attack surface, thwart in-progress attacks, and govern privileged access while enabling secure remote access for outsourced IT administrators and third-party developers.
